Analysis
- user interaction
yes - max time kernel
242s - max time network
246s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 12:31
General
- Target decompiler.exe
- Size 78KB
- Sample260724-pp7xeszfrd
- SHA256 407f9ea6df1cb7383d6e8b6047b80aeb56737943f3c11398aab66f6386f834f4
Malware Config
Extracted
-
discordrat
-
discord_token
MTUzMDE4NDgzMzg5MDc4MzMxMg.GSi6yJ.vPqNiCcCCEONtmWikHZYQ-SYLyF-KdQ3QLxTe8
-
server_id
1522851259575570574
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\decompiler.exe"C:\Users\Admin\AppData\Local\Temp\decompiler.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1772-0-0x000001B2FC1E0000-0x000001B2FC1F8000-memory.dmp
memory/1772-1-0x00007FFD60BFF000-0x00007FFD60C00000-memory.dmp
memory/1772-2-0x000001B2FE950000-0x000001B2FEB12000-memory.dmp
memory/1772-3-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-4-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-5-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-6-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-7-0x000001B2FF150000-0x000001B2FF678000-memory.dmp
memory/1772-8-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-9-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-10-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-11-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-12-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-13-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-14-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-15-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp
memory/1772-16-0x00007FFD60A70000-0x00007FFD61414000-memory.dmp